Crypto ATM / kiosk operator in Finland
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in Finland with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- Registration as a 'virtual currency provider' (VCP) with FIN-FSA under the Act on Virtual Currency Providers (572/2019) is required — covers fiat-to-crypto and crypto-to-crypto exchange services at kiosks.
- Customer due diligence (CDD) obligations under the Act on Virtual Currency Providers and AML/CTF requirements, including risk assessment and internal control mechanisms as mandated by FIN-FSA supervision.
- Suspicious transaction reports (STRs) must be filed with the Financial Intelligence Unit (FIU) at the National Bureau of Investigation.
- No specific cash-transaction threshold (e.g., $/€10,000 equivalent) is stated in the provided facts; cash-in/cash-out at kiosks would trigger enhanced KYC/CDD obligations due to high-risk profile.
- Professional indemnity insurance is required — no specific minimum share capital requirement under Finnish law for VCPs.
- Ongoing compliance with MiCA requirements — full enforcement across all covered activities by 2026, with transparency disclosures, clear terms of use, and customer support mechanisms.
Key Restrictions
- Must be a Finnish limited liability company (osakeyhtiö) or a branch of a limited liability company incorporated in an EEA country.
- Management (CEO and at least one other board member) must be located in Finland.
- Must register with FIN-FSA as a virtual currency provider before commencing operations — providing services without registration has resulted in public warnings/enforcement actions.
- Real-time transaction monitoring systems and KYC/AML data reporting capabilities must be invested in to comply with MiCA standards.
Key Risks
- High AML/CTF risk profile of cash-based crypto kiosks increases scrutiny from FIN-FSA and FIU.
- Enforcement precedent: FIN-FSA has issued public reprimands (Coinmotion Oy, 2022) and public warnings (Tesseract Finance Oy/Stableton, 2023) for AML/CDD deficiencies and unregistered operations.
- No specific cash-transaction reporting threshold is clear from provided facts — ambiguity on whether EU AML package thresholds apply or if FIN-FSA sets bespoke limits for kiosk cash transactions.
- MiCA gradual rollout (2024-2026) creates transitional regulatory uncertainty; full enforcement may impose additional requirements not yet detailed.
- Public warning/reprimand is a formal disciplinary measure that marks the company's regulatory record and can affect reputation and future licensing.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Financial Supervisory Authority (FIN-FSA): The primary regulator responsible for authorizing and supervising all crypto-asset service providers, ensuring compliance with anti-money laundering (AML), consumer protection standards, and operational requirements.
Financial Intelligence Unit (FIU): Operates within the National Bureau of Investigation to receive and investigate suspicious transaction reports from crypto service providers, focusing on preventing money laundering and terrorist financing.
Issuance of licenses for providers offering stablecoins and other crypto assets.
2026: Full enforcement across all covered activities.
Mandatory transparency disclosures regarding the nature, risks, and costs associated with crypto assets.
Requirements for clear terms of use and accessible customer support mechanisms.
Technology Upgrades: Invest in systems that support real-time transaction monitoring, KYC/AML checks, and data reporting capabilities as stipulated by MiCA.
Providing services for exchanging virtual currency and fiat currency: This covers entities facilitating the purchase or sale of virtual currencies using traditional currencies (e.g., EUR, USD).
Exchanges: Both exchanges offering fiat-to-crypto and crypto-to-crypto trading services are clearly defined as "virtual currency providers" and require registration with the FIN-FSA.
The applicant must be a Finnish limited liability company (osakeyhtiö) or a branch of a limited liability company incorporated in an EEA country.
The management of the applicant must be located in Finland. This includes the CEO and at least one other member of the board of directors.
Capital Requirements (Professional Indemnity Insurance):
Entity Targeted: Tesseract Finance Oy (now operating as Stableton). Violation Type: Providing virtual currency services without proper registration for a period, and deficiencies in internal control mechanisms, risk assessment, and customer due diligence processes for Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF). Penalty Amount: Public warning (julkinen varoitus). While not a monetary fine, it's a formal and significant disciplinary measure by the FIN-FSA, obliging the company to rectify its shortcomings. Outcome: The company was required to implement corrective measures to comply with the Virtual Currency Providers Act and AML/CTF obligations. The public warning serves as a significant mark on the company's regulatory record.
Entity Targeted: Coinmotion Oy (a registered virtual currency provider in Finland). Violation Type: Deficiencies in compliance with Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) obligations, specifically regarding customer due diligence, risk assessment, and internal control. The FIN-FSA found that Coinmotion's practices did not fully meet the requirements of the Act on Virtual Currency Providers and the Anti-Money Laundering Act. Penalty Amount: Public reprimand (julkinen huomautus). Similar to the public warning, this is a formal, non-monetary disciplinary action, indicating serious shortcomings that required immediate correction. Outcome: Coinmotion Oy was instructed to rectify the identified deficiencies in its AML/CTF processes to ensure full compliance with regulatory requirements.
Outcome: The company was required to implement corrective measures to comply with the Virtual Currency Providers Act and AML/CTF obligations. The public warning serves as a significant mark on the company's regulatory record.
Outcome: Coinmotion Oy was instructed to rectify the identified deficiencies in its AML/CTF processes to ensure full compliance with regulatory requirements.
Legal Basis: The primary legal framework is the Act on Virtual Currency Providers (572/2019), which came into force in Finland on May 1, 2019. This Act places virtual asset service providers (VASPs) under the supervision of the Finnish Financial Supervisory Authority (FIN-FSA) and subjects them to AML/CFT obligations akin to traditional financial institutions.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Crypto ATM/kiosk operators may operate in Finland but must register as a virtual currency provider with FIN-FSA, be a Finnish or EEA-incorporated entity with management in Finland, comply with AML/CDD obligations under the Act on Virtual Currency Providers (572/2019), and prepare for full MiCA enforcement by 2026.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?